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AMENDMENTS TO THE CLAIMS 

1 . (Currently amended) A method for rule-based network management, the method 
comprising the computer-implemented steps of: 

a network management computer defining and storing a set of rules in one or more Rule- 
Based Markup Language ("RBML") documents, wherein the one or more RBML 
documents include one or more tags defining one or more rule elements, and 
wherein the set of rules includes: 

a symptom-event rule that identifies as a symptom a particular event occurring 
within a first network in a plurality of networks; and 

a problem-diagnosis rule that defines a problem within the network as a 
correlation between one or more symptoms; 

wherein a symptom comprises an indication of a problem in a network element that 
results from an event occurring or being true or pertinent data exceeding a 
threshold: 

wherein a problem comprises a certain set of symptoms that occur a prescribed number of 

times in a specified time interval; 
the network management computer collecting and storing symptom-related data about 

one or more symptoms, wherein collecting and storing the symptom-related data 

includes monitoring the network for one or more network events identified in the 

symptom-event rule; and 
the network management computer detecting a problem within the network, wherein 

detecting the problem includes applying the problem-diagnosis rule to the 

symptom-related data; 

the network management computer r eceiving a request from a user to employ a particular 
rule in managing a second network, separate from the first network; and 

distributing to a device on the second network the one or more RBML documents storing 
the particular rule. 

2. (Original) A method as recited in Claim 1, the method further comprising reviewing the 
set of rules to identify and resolve a conflict between two or more rules in the set. 
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3. (Original) A method as recited in Claim 1, the method further comprising storing the one 
or more RBML documents in a rule repository, wherein the rule repository includes one or more 
directories containing RBML documents. 



4. (Original) A method as recited in Claim 1, wherein a RBML document storing the 
problem-diagnosis rule includes: 

a problem-definition tag describing a problem; and 

a correlation tag identifying the coirelation between one or more symptoms, wherein the 
one or more symptoms are defined in one or more symptom tags that include one 
or more pre-defined indicators associated with the one or more symptoms. 



5. (Original) A method as recited in Claim 4, wherein the step of detecting a problem within 
the network further comprises the steps of: 

comparing the symptom-related data to the one or more pre-defined indicators associated 

with a particular symptom to determine whether the particular symptom exists in 

the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 

6. (Original) A method as recited in Claim 1, wherein a RBML document storing the 

symptom-event rule includes: 

an event tag identifying the particular event occurring on the network; and 

a symptom tag identifying a symptom as a generalized abstraction of the particular event. 



7. (Original) A method as recited in Claim 6, wherein the RBML document storing the 
symptom-event rule further includes: 
a profile tag identifying a particular network device; and 
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a command tag identifying a data-collection command, wherein the data-collection 

command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

8. (Original) A method as recited in Claim 1, wherein: 

the set of rules further includes a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the method further comprises the step of recommending to a user one or more corrective 
actions defined in a RBML document storing the problem-correction rule. 

9. (Original) A method as recited in Claim 8, the method further comprising the step of 
applying to a network device, without user intervention, one or more corrective actions 
defined in the problem-correction rule. 

10. (Canceled) 

1 1 . (Currently amended) A method for defining a Rule-Based Markup Language ("RBML") 
to describe a set of rules for managing a first network among a plurality of networks, the method 
comprising the computer-implemented steps of: 

creating one or more RBML documents for storing the set of mles, wherein the one or 
more RBML documents include one or more tags defining one or more rule 
elements, and wherein: 

a RBML document storing a symptom-event rule from the set of nales includes: 
an event tag identifying a particular event occuning on the network; and 
a symptom tag identifying a symptom as a generalized abstraction of the 
particular event; and 

a RBML document storing a problem-diagnosis rule from the set of rules 
includes: 

a problem-definition tag describing a problem; and 
a correlation tag identifying a correlation between one or more symptoms, 
wherein the one or more symptoms are defined in one or more 
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symptom tags that include one or more pre-defined indicators 
associated with the one or more symptoms; and 

wherein each of the RBML documents comprises a profile block, event block, 
summary block, corrective action block, and match block, wherein the 
profile block identifies network profile elements to which a rule applies, 
wherein an event block defines which events published by a target device 
mav constitute a recognized symptom, wherein the summary block 
comprises metadata defining what services or systems are entitled to use 
or execute a rule; wherein the corrective action block defines one or more 
actions that can and should be taken to correct a problem that has been 
deteimined to exist; wherein the match block comprises one or more 
match statements that mav be applied to raw data to either parse or make a 
determination about the data; 
generating, from information stored in one or more tags of the one or more RBML 

documents, one or more sequences of instructions, which instructions, when 

executed by one or more processors, cause the one or more processors to carry out 

the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event rule; and 

detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 

receiving a request from a user to employ a particular rule in managing a second 
network, separate from the first network; and 

distributing to a device on the second network the one or more RBML documents 
storing the particular rule. 

(Original) A method as recited in Claim 11, wherein the step of detecting a problem 
within the network further comprises the steps of: 
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comparing the symptom-related data to the one or more pre-defined indicators associated 

with the one or more symptoms to determine whether a particular symptom exists 

in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 

13. (Original) A method as recited in Claim 11, wherein the RBML document storing the 
symptom-event mle further includes: 

a profile tag identifying a particular network device; and 

a command tag identifying a data-collection command, wherein the data-collection 
command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

14. (Original) A method as recited in Claim 11, wherein: 

the step of creating one or more RBML documents further includes creating a RBML 
document for storing a problem-coiTection mle defining one or more corrective 
actions capable of correcting the problem within the network; and 

the step of generating instructions includes generating one or more sequences of 

instructions, which instructions, when executed by the one or more processors, 
cause the one or more processors to carry out the step of recommending to a user 
the one or more corrective actions defined in the RBML document storing the 
problem-correction rule. 

15. (Currently amended) An apparatus for rule-based network management, comprising: 

a rule editor for creating and storing, in one or more Rule-Based Markup Language 
("RBML") documents containing one or more tags, a set of rules employed in 
managing a first network among a plurality of networks, wherein the set of rules 
includes: 



CPOL 185311 



6 



Ser. No. 10/714,158 filed 1 1/13/2003 
Sinclair et al.- Art Unit 2453 
Docket No. 50325-081 1 

a symptom-event rule that identifies as a symptom a particular event occurring 

within the network; and 
a problem-diagnosis rule that defines a problem within the network as a 

correlation between one or more symptoms; 
wherein a symptom comprises an indication of a problem in a network element that 
results from an event occurring or being true or pertinent data exceeding a 
threshold; 

wherein a problem comprises a certain set of svmptoms that occur a prescribed number of 

times in a specified time interval; 
one or more processors; 

a diagnosis engine including one or more stored sequences of instructions which, when 

executed by the one or more processors, cause the one or more processors to carry 
out the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event rule; and 

detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 
a rule broker configured to receive a request from a user to apply a particular nale in 

managing a second network, separate from the first network, and to distribute to a 

device on the second network the one or more RBML documents storing the 

particular-^ttle T rule; 

receiving a request from a user to employ a particular rule in managing a second 

network, separate from the first network; and 
distributing to a device on the second network the one or more RBML documents 

storing the particular rule. 

16. (Original) An apparatus as recited in Claim 15, wherein the rule editor is capable of 

providing to a user means for reviewing the set of rules to identify and resolve a conflict 
between two or more rules in the set. 
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17. (Original) An apparatus as recited in Claim 15, wherein: 

the problem-diagnosis rule defining the correlation between one or more symptoms 
includes one or more pre-defined indicators associated with the one or more 
symptoms; and 

the diagnosis engine instructions for carrying out the step of detecting a problem within 
the network further include instructions for carrying out the steps of: 
comparing the symptom-related data to the one or more pre-defined indicators 

associated with the one or more symptoms to determine whether a 

particular symptom exists in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms 

identified in the problem-diagnosis mle; and 
only if all coixelated symptoms identified in the problem-diagnosis rule exist, 

determining that the problem defined in the problem-diagnosis rule is 

detected. 

18. (Original) An apparatus as recited in Claim 15, wherein the symptom-event rule further 
includes: 

information identifying a particular network device; and 

a data-collection command, wherein the data-collection command, when executed on the 
particular network device, returns symptom-related data associated with the 
particular network device. 

19. (Original) An apparatus as recited in Claim 15, wherein: 

the set of rules further includes a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the diagnosis engine further includes instructions which, when executed by the one or 
more processors, cause the one or more processors to carry out the step of 
recommending to a user one or more corrective actions defined in the problem- 
correction rule. 
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20. (Original) An apparatus as recited in Claim 19, wherein the diagnosis engine further 
includes instructions which, when executed by the one or more processors, cause the one or more 
processors to carry out the step of applying to a network device, without user intervention, one or 
more corrective actions defined in the problem-correction rule. 

21. (Canceled) 

22. (Currently amended) A computer-readable storage medium carrying one or more 
sequences of instructions for rule-based network management, which instructions, when 
executed by one or more processors, cause the one or more processors to carry out the steps of: 

defining and storing a set of rules in one or more Rule-Based Markup Language 

("RBML") documents, wherein the one or more RBML documents include one or 
more tags defining one or more rule elements, and wherein the set of rules 
includes: 

a symptom-event mle that identifies as a symptom a particular event occurring 
within a first network among a plurality of networks; and 

a problem-diagnosis rule that defines a problem within the network as a 
correlation between one or more symptoms; 
wherein a symptom comprises an indication of a problem in a network element that 

results from an event occurring or being true or pertinent data exceeding a 

threshold; 

wherein a problem comprises a certain set of symptoms that occur a prescribed number of 

times in a specified time interval; 
collecting and storing symptom- related data about one or more symptoms, wherein 

collecting and storing the symptom-related data includes monitoring the network 

for one or more network events identified in the symptom-event rule; and 
detecting a problem within the network, wherein detecting the problem includes applying 

the problem-diagnosis rule to the symptom-related data; 
receiving a request from a user to employ a particular rule in managing a second network, 

separate from the first network; 
distributing to a device on the second network the one or more RBML documents storing 

the particular rule. 
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23. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
further comprising instructions which, when executed by the one or more processors, 
cause the one or more processors to carry out the step of reviewing the set of rules to 
identify and resolve a conflict between two or more rules in the set. 

24. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
further comprising instructions which, when executed by the one or more processors, 
cause the one or more processors to carry out the step of storing the one or more RBML 
documents in a rule repository, wherein the rule repository includes one or more 
directories containing RBML documents. 

25. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
wherein a RBML document storing the problem-diagnosis rule includes: 

a problem-definition tag describing a problem; and 

a coirelation tag identifying the correlation between one or more symptoms, wherein the 
one or more symptoms are defined in one or more symptom tags that include one 
or more pre-defined indicators associated with the one or more symptoms. 

26. (Previously presented) A computer-readable storage medium as recited in Claim 25, 
further comprising instructions which, when executed by the one or more processors, 
cause the one or more processors to carry out the steps of: 

comparing the symptom-related data to the one or more pre-defined indicators associated 

with a particular symptom to determine whether the particular symptom exists in 

the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected 

27. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
wherein a RBML document storing the symptom-event rule includes: 
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an event tag identifying the particular event occurring on the network; and 

a symptom tag identifying a symptom as a generalized abstraction of the particular event. 

28. (Previously presented) A computer-readable storage medium as recited in Claim 27, 
wherein the RBML document storing the symptom-event rule further includes: 
a profile tag identifying a particular network device; and 

a command tag identifying a data-collection command, wherein the data-collection 
command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

29. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
wherein: 

the set of rules further includes a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the computer-readable medium further comprises instructions which, when executed by 
the one or more processors, cause the one or more processors to carry out the step 
of recommending to a user one or more corrective actions defined in a RBML 
document storing the problem-correction rule. 

30. (Previously presented) A computer-readable storage medium as recited in Claim 29, 
further comprising instructions which, when executed by the one or more processors, 
cause the one or more processors to carry out the step of applying to a network device, 
without user intervention, one or more corrective actions defined in the problem- 
correction rule. 

31. (Canceled) 

32. (Currently amended) A computer-readable storage medium carrying one or more 
sequences of instructions for defining a Rule-Based Markup Language ("RBML") to 
describe a set of rules for managing a first network among a plurality of networks, which 
instructions, when executed by one or more processors, cause the one or more processors 
to carry out the steps of: 
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creating one or more RBML documents for storing the set of rules, wherein the one or 
more RBML documents include one or more tags defining one or more rule 
elements, and wherein: 

a RBML document storing a symptom-event rule from the set of rules includes: 
an event tag identifying a particular event occurring on the network; and 
a symptom tag identifying a symptom as a generalized abstraction of the 
particular event; and 

a RBML document storing a problem-diagnosis rule from the set of rules 
includes: 

a problem-definition tag describing a problem; and 

a correlation tag identifying a correlation between one or more symptoms, 
wherein the one or more symptoms are defined in one or more 
symptom tags that include one or more pre-defmed indicators 
associated with the one or more symptoms; and 
wherein each of the RBML documents comprises a profile block, event block, summary 
block, corrective action block, and match block, wherein the profile block 
identifies network profile elements to which a rule applies, wherein an event 
block defines which events published by a target device may constitute a 
recognized symptom, wherein the summary block comprises metadata defining 
what services or systems are entitled to use or execute a rule; wherein the 
corrective action block defines one or more actions that can and should be taken 
to correct a problem that has been determined to exist; wherein the match block 
comprises one or more match statements that may be applied to raw data to either 
parse or make a determination about the data; 
generating, from information stored in one or more tags of the one or more RBML 
documents, one or more sequences of instructions, which instructions, when 
executed by one or more processors, cause the one or more processors to carry out 
the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event rule; and 
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detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 

receiving a request from a user to employ a particular rule in managing a second 
network, separate from the first network; and 

distributing to a device on the second network the one or more RBML documents 
storing the particular rule. 

33. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein the instructions for detecting a problem within the network further comprise 
instructions for carrying out the steps of: 

comparing the symptom-related data to the one or more pre-defined indicators associated 

with the one or more symptoms to determine whether a particular symptom exists 

in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the con-elation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 

34. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein the RBML document storing the symptom-event rule further includes: 

a profile tag identifying a particular network device; and 

a command tag identifying a data-collection command, wherein the data-collection 
command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

35. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein: 

the instructions for creating one or more RBML documents further comprise instructions 
for carrying out the step of creating a RBML document for storing a problem- 
correction rule defining one or more corrective actions capable of correcting the 
problem within the network; and 
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the instructions for generating one or more sequences of instructions, by using 

information stored in one or more tags of one or more RBML documents, further 
comprise instructions for carrying out the step of recommending to a user the one 
or more corrective actions defined in the RBML document storing the problem- 
correction rule. 
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